workbook
Prepare and control a DPIA decision record
Prepare each decision input on a controlled working page before reviewed information is entered into the staged Privora Pro workflow.
Non-persisted working reference
Use this workbook to prepare notes, evidence references, owners, decisions, and follow-up. Entries are temporary in this browser. Nothing entered on this page is saved. It is not submitted; enter the approved record in Privora Pro when the review is complete.
Browser-local worksheet
Prepare working answers
Entries are temporary in this browser. They are not submitted or saved. Enter approved records in Privora Pro.
0 of 55 prepared
Prepare and control a DPIA decision record
This blank workbook supports preparation. It is not the approval record and does not submit anything to the NDPC. Treat completed pages as confidential working material. Privora Pro remains the operating record after reviewed information is entered.
Data-minimisation rule: Do not record passwords, secrets, raw sensitive data, full identity documents, live credentials, exploitable security detail, or unnecessary personal data here. Store source evidence in the authorised Privora Pro workspace and use references on these pages.
How to use the working pages
Complete the pages with the responsible owners, mark assumptions, and identify the source for each material fact. The privacy lead reviews contributions before transferring approved information into Privora Pro. A contributor may prepare a response but cannot change formal risk ratings, record a regulator outcome, certify the DPO review, or approve processing.
Use concise references rather than copying evidence. If a field needs sensitive operational detail, record a safe evidence ID and location. Date decisions and retain the current workbook version with the engagement's approved records policy.
Page 1 — Workflow charter
Define the decision this DPIA must inform and the operating boundary around it.
Add a concise working answer.
DPIA title
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Authorised Privora Pro client workspace
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Select the current decision.
Processing stage
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Choose the relevant date.
Date the assessment must inform the processing decision
Choose the relevant date.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Decision this assessment must support
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Page 2 — Roles and authority
Name individuals, not only departments. Confirm who may contribute, evaluate, recommend, approve, and communicate externally.
Add a concise working answer.
Privacy lead or DPCO consultant
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Business or system owner
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Security or control owner
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Authorised management reviewer
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Certified DPO reviewer
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Segregation, conflict, or authority exceptions requiring escalation
When approved, record the result in the matching Privora Pro workflow
Page 3 — Trigger and timing screen
Record why the activity may create high risk and what must remain paused until the assessment informs the decision.
Select every check that is complete.
Potential high-risk triggers
Select every check that is complete.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Connection between the selected trigger and possible rights impact
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Processing, procurement, pilot, or launch activity held behind the assessment gate
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Source or evidence reference for the trigger decision
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Page 4 — Scope and data flow
Prepare a reviewer-readable description from collection through deletion. Use a separate approved diagram where necessary and reference it here.
Capture the working notes, source, and decision context.
Nature, scope, context, and purpose of processing
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Affected groups, vulnerability factors, and approximate scale
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Personal and sensitive data categories using safe category names only
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Approved data-flow or architecture evidence reference
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Retention, deletion, processing locations, and hosting locations
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Recipients, processors, purposes, locations, and contract status
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Controls that detect purpose or scope expansion
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Page 5 — Lawful basis, necessity, and alternatives
Prepare the analysis for qualified review. A selected label does not establish a lawful conclusion.
Capture the working notes, source, and decision context.
Claimed lawful basis and purpose-specific rationale
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Why the purpose cannot reasonably be achieved with less personal data
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Benefits, intrusion, affected interests, and proportionality analysis
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Less intrusive alternatives and disposition
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Page 6 — Contribution register
Plan scoped requests. Do not paste portal responses here; reference the task and record the privacy team's review result.
| Contribution | Contributor role | Acceptance criteria | Privora task reference | Review owner |
|---|---|---|---|---|
| Processing context | Business owner | Complete flow, systems, recipients, retention | ||
| Control evidence | Security owner | Period, control, operation, gap, evidence reference | ||
| Stakeholder view | Relevant representative | Rights, fairness, CIA impact, recommended change | ||
| Management recommendation | Authorised reviewer | Go ahead, modify, or stop recommendation with conditions |
Capture the working notes, source, and decision context.
Missing, conflicting, returned, or late contributions
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Privacy-team evaluation of contribution quality and effect
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Page 7 — Vulnerability and rights impact
Assess impact from the data subject's perspective, not only the organisation's security perspective.
Capture the working notes, source, and decision context.
Confidentiality, integrity, and availability impacts
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Vulnerability, power imbalance, and data-subject impact findings
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Possible exclusion, discrimination, or unequal outcomes
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
How transparency, access, correction, objection, restriction, challenge, and redress operate
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Remediation speed, recovery implications, and operator capacity
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Page 8 — Risk and control record
Use one row per material rights risk in Privora Pro. Summarise only decision-level facts here.
| Risk and effect on people | Likelihood | Severity | Existing or planned control | Owner and target date | Residual risk | Evidence reference |
|---|---|---|---|---|---|---|
Capture the working notes, source, and decision context.
Unverified controls and unresolved treatment gaps
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Privacy-by-design and default measures
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Select every check that is complete.
Treatment readiness checks
Select every check that is complete.
When approved, record the result in the matching Privora Pro workflow
Page 9 — Transfer and rights review
Select the current decision.
Does a cross-border transfer apply?
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Jurisdictions, basis, safeguards, onward transfer, rights, redress, and unresolved issues
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Authentication, accessibility, channel, or operational barriers to rights
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Page 10 — Decision and conditions
The options are go ahead, modify, or stop. Record what the choice authorises and what it does not.
Select the current decision.
Recommended final decision
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Evidence-based rationale for the decision
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Conditions, dependencies, interim restrictions, and monitoring owners
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Unresolved problems carried to escalation or review
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Page 11 — Prior consultation record
Complete only through the organisation's authorised regulatory process. Privora does not create a filing receipt.
Select the current decision.
Does high residual risk require prior NDPC consultation?
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Reviewed material, questions, authority, and approved submission route
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Choose the relevant date.
Authentic consultation date
Choose the relevant date.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Authentic outcome and reference, recorded only after receipt
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Source: Nigeria Data Protection Act 2023, Section 28(2), official PDF p. A735
Page 12 — Sign-off readiness
The certified DPO performs formal vetting in the controlled workflow. This workbook records preparation, not approval. The product's application sign-off is not a cryptographic signature or evidence of regulator endorsement.
Select every check that is complete.
Certified-DPO review pack readiness
Select every check that is complete.
When approved, record the result in the matching Privora Pro workflow
Choose the relevant date.
Planned or completed certified-DPO review date
Choose the relevant date.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Privora Pro review or comments reference
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Select the current decision.
Current controlled state
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Source: General Application and Implementation Directive 2025, Article 28(4), (11)–(13), official PDF printed pp. 33–34
Page 13 — Review and lessons
Select the current decision.
Planned review frequency
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Changes or events that require earlier review
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
What to improve in the next assessment cycle
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Select every check that is complete.
Operating-record completion
Select every check that is complete.
When approved, record the result in the matching Privora Pro workflow
Sources and review boundary
Source: Nigeria Data Protection Act 2023, Section 28(1)–(4), official PDF p. A735
Source: General Application and Implementation Directive 2025, Article 28(1)–(13), official PDF printed pp. 31–34
Privora Pro remains the operating record after the privacy lead and authorised reviewers enter approved information.
Download this operating resource
Download the workbook
Use PDF for review and print. Use the editable DOCX when the team needs a working copy.